Add unit test + fix flow step

Author: joefarebrother

csharp/ql/lib/semmle/code/csharp/frameworks/Razor.qll

@@ -233,12 +233,12 @@ class PageModelClass extends Class {
     )
   }
 
-  /** Gets the Razor Page that this PageModel refers to. */
+  /** Gets the Razor Page that has this PageModel. */
   RazorViewClass getPage() {
-    exists(Field modelField |
-      modelField.hasName("Model") and
-      modelField.getType() = this and
-      modelField.getDeclaringType() = result
+    exists(Property modelProp |
+      modelProp.hasName("Model") and
+      modelProp.getType() = this and
+      modelProp.getDeclaringType() = result
     )
   }
 }

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestModel.cs

@@ -0,0 +1,16 @@
+using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.AspNetCore.Mvc;
+using System.Net;
+using System.Threading.Tasks;
+namespace test;
+
+class TestModel : PageModel {
+    public string Name {get; set; } = "abc";
+
+    private string source() { return "x"; }
+
+    public async Task<IActionResult> OnGetAsync() {
+        Name = source();
+        return Page();
+    }
+}

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestPage.cshtml

@@ -0,0 +1,5 @@
+@page
+@model TestModel
+@namespace test 
+
+<h3>Hello "@Html.Raw(Model.Name)"</h3>

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/TestPage.cshtml.g.cs

@@ -0,0 +1,65 @@
+// A hand-written test file that mimics the output of compiling a `.cshtml` file
+
+// <auto-generated/>
+#pragma warning disable 1591
+[assembly: global::Microsoft.AspNetCore.Razor.Hosting.RazorCompiledItemAttribute(typeof(test.Pages.Pages_TestPage), @"mvc.1.0.razor-page", @"TestPage.cshrml")]
+namespace test.Pages
+{
+    #line hidden
+    using System;
+    using System.Collections.Generic;
+    using System.Linq;
+    using System.Threading.Tasks;
+    using Microsoft.AspNetCore.Mvc;
+    using Microsoft.AspNetCore.Mvc.Rendering;
+    using Microsoft.AspNetCore.Mvc.ViewFeatures;
+#nullable restore
+using test;
+
+#line default
+#line hidden
+#nullable disable
+    [global::Microsoft.AspNetCore.Razor.Hosting.RazorSourceChecksumAttribute(@"SHA1", @"c4ae76542f1958092cebd8f57beef899d20fc548", @"TestPage.cshtml")]
+    // [global::Microsoft.AspNetCore.Razor.Hosting.RazorSourceChecksumAttribute(@"SHA1", @"c13da96c2597d5ddb7d415fb4892c644a268f50b", @"/Pages/_ViewImports.cshtml")]
+    internal sealed class Pages_TestPage : global::Microsoft.AspNetCore.Mvc.RazorPages.Page
+    {
+        #pragma warning disable 1998
+        public async override global::System.Threading.Tasks.Task ExecuteAsync()
+        {
+#nullable disable
+            WriteLiteral("<h3>Hello \"");
+#nullable restore
+#line 5 "TestPage.cshtml"
+Write(Html.Raw(Model.Name));
+
+#line default
+#line hidden
+#nullable disable
+            WriteLiteral("\"</h3>\n");
+#nullable restore
+        }
+              #pragma warning restore 1998
+        #nullable restore
+        [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
+        public global::Microsoft.AspNetCore.Mvc.ViewFeatures.IModelExpressionProvider ModelExpressionProvider { get; private set; } = default!;
+        #nullable disable
+        #nullable restore
+        [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
+        public global::Microsoft.AspNetCore.Mvc.IUrlHelper Url { get; private set; } = default!;
+        #nullable disable
+        #nullable restore
+        [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
+        public global::Microsoft.AspNetCore.Mvc.IViewComponentHelper Component { get; private set; } = default!;
+        #nullable disable
+        #nullable restore
+        [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
+        public global::Microsoft.AspNetCore.Mvc.Rendering.IJsonHelper Json { get; private set; } = default!;
+        #nullable disable
+        #nullable restore
+        [global::Microsoft.AspNetCore.Mvc.Razor.Internal.RazorInjectAttribute]
+        public global::Microsoft.AspNetCore.Mvc.Rendering.IHtmlHelper<TestModel> Html { get; private set; } = default!;
+        #nullable disable
+        public global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<TestModel> ViewData => (global::Microsoft.AspNetCore.Mvc.ViewFeatures.ViewDataDictionary<TestModel>)PageContext?.ViewData;
+        public TestModel Model => ViewData.Model;    }
+}
+#pragma warning restore 1591

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/options

@@ -0,0 +1,3 @@
+semmle-extractor-options: /nostdlib /noconfig
+semmle-extractor-options: --load-sources-from-project:${testdir}/../../../../resources/stubs/_frameworks/Microsoft.NETCore.App/Microsoft.NETCore.App.csproj
+semmle-extractor-options: --load-sources-from-project:../../../../resources/stubs/_frameworks/Microsoft.AspNetCore.App/Microsoft.AspNetCore.App.csproj

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/test.expected

@@ -0,0 +1 @@
+| TestPage.cshtml:5:16:5:25 | access to property Name | TestModel.cs:13:16:13:23 | call to method source | TestPage.cshtml:5:16:5:25 | access to property Name | Xss |

csharp/ql/test/query-tests/Security Features/CWE-079/XssPageModels/test.ql

@@ -0,0 +1,19 @@
+import csharp
+import semmle.code.csharp.security.dataflow.XSSQuery
+import semmle.code.csharp.security.dataflow.XSSSinks
+
+module TestXssTrackingConfig implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node source) {
+    source.asExpr().(MethodCall).getTarget().getName() = "source"
+  }
+
+  predicate isSink = XssTrackingConfig::isSink/1;
+
+  predicate isBarrier = XssTrackingConfig::isBarrier/1;
+}
+
+module TestXss = TaintTracking::Global<TestXssTrackingConfig>;
+
+from DataFlow::Node source, DataFlow::Node sink
+where TestXss::flow(source, sink)
+select sink, source, sink, "Xss"